Merge remote-tracking branch 'origin/master' into splitting5

Samsung · Jun 12, 2024 · 8f7261e · 8f7261e
2 parents 57dbbd0 + 8b7e7fa
commit 8f7261e
Show file tree

Hide file tree

Showing 369 changed files with 20,102 additions and 7,820 deletions.
diff --git a/.github/workflows/runAsimSchemaAndDataTesters.yaml b/.github/workflows/runAsimSchemaAndDataTesters.yaml
@@ -37,7 +37,7 @@ jobs:
             persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal access token.
             fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
       - name: Login to Azure Public Cloud with AzPowershell
-        uses: azure/login@v1
+        uses: azure/login@v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}

diff --git a/.script/dataConnectorValidator.ts b/.script/dataConnectorValidator.ts
@@ -144,6 +144,10 @@ function getConnectorCategory(dataTypes : any, instructionSteps:[])
   {
     return ConnectorCategory.CybleThreatIntel;
   }
+  else if (dataTypes[0].name.includes("IndicatorsOfCompromise"))
+  {
+    return ConnectorCategory.CrowdStrikeFalconIOC;
+  }
   return "";
 } 
 let fileTypeSuffixes = ["json"];

diff --git a/.script/tests/KqlvalidationsTests/CustomTables/BitwardenEventLogs_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/BitwardenEventLogs_CL.json
@@ -0,0 +1,49 @@
+{
+    "Name": "BitwardenEventLogs_CL",
+    "Properties": [
+        {
+            "name": "TimeGenerated",
+            "type": "Datetime"
+        },
+        {
+            "name": "eventType",
+            "type": "int"
+        },
+        {
+            "name": "itemId",
+            "type": "string"
+        },
+        {
+            "name": "collectionId",
+            "type": "string"
+        },
+        {
+            "name": "groupId",
+            "type": "string"
+        },
+        {
+            "name": "policyId",
+            "type": "string"
+        },
+        {
+            "name": "memberId",
+            "type": "string"
+        },
+        {
+            "name": "actingUserId",
+            "type": "string"
+        },
+        {
+            "name": "installationId",
+            "type": "string"
+        },
+        {
+            "name": "device",
+            "type": "int"
+        },
+        {
+            "name": "ipAddress",
+            "type": "string"
+        }
+    ]
+}
diff --git a/.script/tests/KqlvalidationsTests/CustomTables/BitwardenGroups_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/BitwardenGroups_CL.json
@@ -0,0 +1,17 @@
+{
+    "Name": "BitwardenGroups_CL",
+    "Properties": [
+        {
+            "name": "TimeGenerated",
+            "type": "Datetime"
+        },
+        {
+            "name": "groupId",
+            "type": "string"
+        },
+        {
+            "name": "name",
+            "type": "string"
+        }
+    ]
+}
diff --git a/.script/tests/KqlvalidationsTests/CustomTables/BitwardenMembers_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/BitwardenMembers_CL.json
@@ -0,0 +1,25 @@
+{
+    "Name": "BitwardenMembers_CL",
+    "Properties": [
+        {
+            "name": "TimeGenerated",
+            "type": "Datetime"
+        },
+        {
+            "name": "memberId",
+            "type": "string"
+        },
+        {
+            "name": "userId",
+            "type": "string"
+        },
+        {
+            "name": "email",
+            "type": "string"
+        },
+        {
+            "name": "name",
+            "type": "string"
+        }
+    ]
+}
diff --git a/.script/tests/KqlvalidationsTests/CustomTables/CommvaultSecurityIQ_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/CommvaultSecurityIQ_CL.json
@@ -0,0 +1,98 @@
+{
+    "Name": "CommvaultSecurityIQ_CL",
+    "properties":
+    [
+        {
+            "Name": "anomaly_sub_type_s",
+            "Type": "String"
+        },
+        {
+            "Name": "created_files_count_s",
+            "Type": "String"
+        },
+        {
+            "Name": "deleted_files_count_s",
+            "Type": "String"
+        },
+        {
+            "Name": "description_s",
+            "Type": "String"
+        },
+        {
+            "Name": "external_link_s",
+            "Type": "String"
+        },
+        {
+            "Name": "files_list_s",
+            "Type": "String"
+        },
+        {
+            "Name": "job_end_time_s",
+            "Type": "String"
+        },
+        {
+            "Name": "job_id_s",
+            "Type": "String"
+        },
+        {
+            "Name": "job_start_time_s",
+            "Type": "String"
+        },
+        {
+            "Name": "originating_client_s",
+            "Type": "String"
+        },
+        {
+            "Name": "scanned_folder_list_s",
+            "Type": "String"
+        },
+        {
+            "Name": "severity_s",
+            "Type": "String"
+        },
+        {
+            "Name": "subclient_id_d",
+            "Type": "Real"
+        },
+        {
+            "Name": "user_id_d",
+            "Type": "Real"
+        },
+        {
+            "Name": "username_s",
+            "Type": "String"
+        },
+        {
+            "Name": "Computer",
+            "Type": "String"
+        },
+        {
+            "Name": "ManagementGroupName",
+            "Type": "String"
+        },
+        {
+            "Name": "MG",
+            "Type": "Guid"
+        },
+        {
+            "Name": "RawData",
+            "Type": "String"
+        },
+        {
+            "Name": "SourceSystem",
+            "Type": "String"
+        },
+        {
+            "Name": "TenantId",
+            "Type": "Guid"
+        },
+        {
+            "Name": "TimeGenerated",
+            "Type": "Datetime"
+        },
+        {
+            "Name": "Type",
+            "Type": "String"
+        }
+    ]
+}
diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
@@ -47,6 +47,7 @@
   "CEF",
   "CheckPoint",
   "CiscoASA",
+  "CiscoAsaAma",
   "CiscoDuoSecurity",
   "CiscoFirepowerEStreamer",
   "CiscoISE",
@@ -239,5 +240,7 @@
   "InfobloxSOCInsightsDataConnector_Legacy",
   "InfobloxSOCInsightsDataConnector_AMA",
   "NetskopeDataConnector",
-  "NetskopeWebTransactionsDataConnector"
+  "NetskopeWebTransactionsDataConnector",
+  "CefAma",
+  "WindowsFirewallAma"
 ]
diff --git a/.script/utils/dataConnector.ts b/.script/utils/dataConnector.ts
@@ -211,5 +211,6 @@ export enum ConnectorCategory {
   PowerBIActivity="PowerBIActivity",
   SecurityAlertOATP="SecurityAlert(OATP)",
   SecurityAlertASC="SecurityAlert(ASC)",
-  CybleThreatIntel="CybleThreatIntel"
+  CybleThreatIntel="CybleThreatIntel",
+  CrowdStrikeFalconIOC="CrowdStrikeFalconIOC"
 }